The DPS, consisting of various hardware
components and self-contained software, provides the entire shuttle with
computerized monitoring and control. DPS functions are:

Support the guidance, navigation, and control of the vehicle, including
calculations of trajectories, SSME burn data, and vehicle attitude control
data.

Monitor and control vehicle subsystems, such
as the electrical power system and the environmental control and life
support system.

Process vehicle data for the flight crew and
for transmission to the ground, and allow ground control of some vehicle
systems via transmitted commands.

Check data transmission errors and crew
control input errors; support annunciation of vehicle system failures and
out-of-tolerance system conditions.

Support payloads with flight crew/software
interface for activation, deployment, deactivation, and retrieval.

Process rendezvous, tracking, and data transmissions between payloads and
the ground.

The DPS hardware consists of five general purpose
computers (GPCs), two mass memory units (MMUs) for large-volume bulk storage,
and a network of serial digital data buses to accommodate the data traffic
between the GPCs and vehicle systems. The DPS also includes 20 orbiter and 4 SRB
multiplexers/demultiplexers (MDMs) to convert and format data from the various
vehicle systems, 3 SSME interface units to command the SSMEs, 4 multifunction
CRTdisplay systems used by the flight crew to
monitor and control the vehicle and payload systems, 2 data bus isolation
amplifiers to interface with the ground support equipment/launch processing
system and the SRBs, 2 master events controllers, and a master timing unit.

DPS software accommodates almost every aspect of
space shuttle operations, including orbiter checkout, prelaunch and final
countdown for launch, turnaround activities, control and monitoring during
launch, ascent, on-orbit activities, entry, and landing, and aborts or other
contingency mission phases. A multicomputer mode is used for the critical phases
of the mission, such as launch, ascent, orbit, entry, landing, and aborts.

The orbiter has five identical IBM AP-101S GPCs.
The GPCs receive and transmit data to and from interfacing hardware via the data
bus network. GPCs also contain the software that provides the main on-board data
processing capability. Up to four of the systems may run identical software. The
fifth system runs different software, programmed by a different company,
designed to take control of the vehicle if an error in the primary software or
other multiple failures cause a loss of vehicle control. The software utilized
by the four primary GPCs is referred to as PASS (primary avionics software
system); the fifth GPC is referred to as BFS (backup flight system).

GPCs 1 and 4 are located in forward middeck
avionics bay 1, GPCs 2 and 5 are located in forward middeck avionics bay 2, and
GPC 3 is located in aft middeck avionics bay 3. The GPCs receive forced-air
cooling from an avionics bay fan. (There are two fans in each avionics bay, but
only one is powered at a time.)

CAUTION

If both fans in an avionics bay fail, the
computers will overheat within 25 minutes (at 14.7 psi cabin pressure) or 17
minutes (at 10.2 psi) after which their operation cannot be relied upon. An
operating GPC may or may not survive for up to an additional 30 minutes beyond
the certifiable thermal limits.

Each GPC consists of a central processing unit
(CPU) and an input/output processor (IOP) stored in one avionics box. The boxes
are 19.55 inches long, 7.62 inches high, and 10.2 inches wide; they weigh
approximately 68 pounds. The main memory of each GPC is volatile (the software
is not retained if power is interrupted), but a battery pack preserves software
contents when the GPC is powered off. The memory capacity of the GPCs is 256 k
half-words, but only the lower 128 k half-words are normally used for software
processing.

The CPU controls access to GPC main memory for
data storage and software execution and executes instructions to control vehicle
systems and manipulate data.

The IOP formats and transmits commands to the
vehicle systems, receives and validates response data transmissions from the
vehicle systems, and maintains the status of interfaces with the CPU and the
other GPCs.

The 24 data buses are connected to each IOP by
bus control elements (BCEs) that receive, convert, and validate serial data in
response to requests for available data to be transmitted or received from
vehicle hardware.

For timing, each GPC contains an oscillator that
sends signals to internal components to regulate operations. The GPC also uses
the oscillator to maintain an internal clock to keep track of Greenwich mean
time (GMT) and mission elapsed time (MET) as a backup to the timing signal from
the master timing unit (MTU).

Each GPC contains a watchdog timer. The watchdog
timer is an incrementing clock register in the GPC that is reset about once
every second by a signal from the CPU. If the register ever overflows, then a
problem exists and is annunciated by a self-fail indication from that GPC. The
PASS set does not utilize this hardware feature since it operates in
synchronization with each of its GPCs to ensure proper functioning. Since the
BFS operates essentially standalone relative to the PASS set synchronization,
the BFS mechanization does utilize the watchdog timer function to serve as a
check on its operation.

The PASS GPCs use a hardware "voter" to monitor
discrete inputs from the other GPCs. Should a GPC receive a fail vote from two
or more of the other GPCs, it will cause the GPC to annunciate a self-fail
indication that also causes the GPC to inhibit any fail votes of its own against
the other GPCs.

hardware controls are located on panel O6. Each of the five
GPCs reads the position of its corresponding OUTPUT and MODE switches and INITIAL PROGRAM
LOAD pushbuttons from discrete input lines that go
directly to the GPC. Each GPC has OUTPUT and MODE
talkback indicators on panel O6 that are driven by GPC output discretes.

Each GPC has a

GENERAL PURPOSE COMPUTER POWER switch on panel O6.
Positioning a switch to ON enables power from three essential buses, ESS 1BC,
2CA, and 3AB. The essential bus power controls remote power controller (RPCs),
which permit main bus DC power from the three main buses (MN A, MN B, and MN C)
to power the GPC. There are three RPCs for each GPC; thus, any GPC will function
normally, even if two main or essential buses are lost. Each computer uses 560
watts of power.

Each

GENERAL PURPOSE COMPUTER
OUTPUT switch on panel O6 is a guarded switch with
BACKUP, NORMAL, and TERMINATE
positions. The switch provides a hardware override to the GPC that precludes
that GPC from outputting on the flight-critical buses. The switches for the PASS
GNC GPCs are positioned to NORMAL, which permits them to
output. The backup flight system switch (GPC 5) is positioned to BACKUP, which precludes it from
outputting until it is engaged. The switch for a GPC designated on-orbit to be a
systems management (SM) computer is positioned to
TERMINATE, since the GPC is not to command anything
on the flight-critical buses.

switch
on panel O6 indicates gray if that GPC output is enabled and barberpole if it is
not.

Each
GPC receives RUN, STBY, or HALT discrete inputs from its
MODE switch on panel O6,
which determines whether that GPC can process software. The MODE switch is lever-locked in
the RUN position. The HALT position initiates a hardware-controlled state in which no
software can be executed. A GPC that fails to synchronize with others is either
powered OFF or moded to HALT as soon as possible to
prevent the failed computer from outputting erroneous commands. The talkback
indicator above the MODE switch for that GPC indicates barberpole when that
computer is in HALT.

In STBY, a GPC is also in a state
in which no PASS software can be executed, but it is in a software-controlled
state. The STBY mode
allows an orderly startup or shutdown of processing. It is necessary, as a
matter of procedure, for a PASS GPC that is shifting from RUN to HALT or vice versa to be
temporarily (more than 3 seconds) in the STBY mode before going to the next state. The STBY mode
allows for an orderly software cleanup and allows a GPC to be correctly
initialized (when reactivated) without an initial program load. If a GPC is
moded to RUN or HALT without pausing in STBY, it may not perform its functions
correctly. There is no STBY indication on the talkback indicator above the MODE switch.

The RUN position
permits a GPC to support its normal processing of all active software and
assigned vehicle operations. Whenever a computer is moded from STBY to RUN,
it initializes itself to a state in which only system software is processed
(called OPS 0). If a GPC is in another operational sequence (OPS) before being
moded out of RUN,
that software still resides in main memory; however, it will not begin
processing until that OPS is restarted by flight crew keyboard entry. The MODE talkback indicator always
reads RUN when that GPC
switch is in RUN,
and no failures exist.

Placing the backup flight system GPC in
STBY does not stop BFS software processing or preclude BFS
engagement; it only prevents the BFS from commanding the payload buses used by
BFS systems management software. The PASS GPC/BUS STATUS display (DISP 6)
indicates the current mode of each PASS GPC in the common set. The display does
not differentiate between STBY and HALT;
only RUN or HALT is displayed (GPC MODE).

The INITIAL
PROGRAM LOAD pushbutton for a GPC on panel O6
activates the initial program load command discrete input when depressed. When
the input is received, that GPC initiates an initial program load (IPL) from the
MMU specified by the IPL SOURCE switch on panel O6. The talkback indicator above the MODE
switch for that GPC indicates IPL

.
During non-critical periods in orbit, only one or two GPCs are used for GNC
tasks, and another is used for systems management and payload operations.

A GPC on orbit can also be "freeze-dried";
that is, it can be loaded with the software for a particular memory
configuration and then moded to

HALT.
Before an OPS transition to the loaded memory configuration, the freeze-dried
GPC can be moded back to RUN and the appropriate OPS requested.

NOTE

Because all BFS software is loaded into the
BFS GPC at the same time, the BFS GPC is sometimes referred to as being
freeze-dried on orbit when it is placed in HALT

.
The BFS GPC can be moded to RUN prior to entry and will begin processing entry
software following the OPS 3 request without having to access a mass memory
unit. The term freeze-dry or freeze-dried is most often used with respect to the
PASS GPCs.

GPC modes of operation are redundant set, common
set, and simplex. Redundant set operations refer to the mode in which two or
more GPCs are concurrently receiving the same inputs, executing the same GNC
software, and producing the same outputs. This mode uses a maximum amount of
inter-computer communications, and the GPCs must maintain a high level of
synchronization (called redundant set synchronization).

During redundant set operations, each GPC outputs
only certain portions of its total software output to its interfacing hardware.
Therefore, although each GPC "thinks" it is performing all its operations, only
the GPC responsible for supporting a specific group of hardware will be able to
actually transmit its data and commands. The redundant set GPCs compare all
calculations to ensure that individual outputs are the same.

Common set operations occur when two or more GPCs
communicate with one another while they are performing their individual tasks.
They do not have to be performing the same major function (although they can
be), but they do maintain common set synchronization. Any GPC operating as a
member of the redundant set is also a member of the common set.

A simplex GPC is in

RUN,
but not a member of the redundant set. Systems management and payload major
functions are always processed in a simplex GPC.

GPCs running together in the same GNC OPS are
part of a redundant set performing identical tasks from the same inputs and
producing identical outputs. Therefore, any data bus assigned to a commanding
GNC GPC (except the instrumentation buses because each GPC has only one
dedicated bus connected to it) is heard by all members of the redundant set.
These transmissions include all CRT inputs and mass memory transactions, as well
as flight critical data. If one or more GPCs in the redundant set fail, the
remaining computers can continue operating in GNC. Each GPC performs about 1.2
million operations per second during critical phases.

Each computer in a redundant set operates in
synchronized steps and cross-checks results of processing hundreds of times per
second. Synchronization refers to the software scheme used to ensure
simultaneous inter-computer communications of necessary GPC status information
among the PASS computers. If a GPC operating in a redundant set fails to meet
any redundant synchronization point, the remaining computers will immediately
vote it out of the redundant set. If a GPC has a problem with one of its
multiplexer interface adapter receivers during two successive reads of response
data, or does not receive data while other members of the redundant set do
receive data, the GPC with the problem will fail-to-sync. A failed GPC is either
powered OFF or moded to HALT as soon as possible by the crew.

GPC failure votes are annunciated in a
number of ways. Each GPC has discrete output lines for fail votes against each
of the other GPCs that go to the other GPCs and the GPC status matrix. A GPC
FAIL detection will cause a class 2 GPC fault message with illumination of the
MASTER ALARM

STATUS matrix
(sometimes referred to as the GPC fail CAM) on panel O1 is a 5-by-5 matrix of
lights. Each light corresponds to a GPC's fail vote against another GPC or
itself. For example, if GPC 2 sends out a failure vote against GPC 3, the second
white light in the third column is illuminated. The off-diagonal votes are votes
against other GPCs. The yellow diagonal lights from upper left to lower right
are self-failure votes. Whenever a GPC receives two or more failure votes from
other GPCs, it illuminates its own yellow light and resets any failure votes
that it made against other GPCs (any white lights in its row are extinguished).
Any time a yellow matrix light is illuminated, the GPC caution and warning light
on panel F7 is illuminated, in addition to MASTER ALARM illumination, and a GPC
fault message is displayed on the CRT.

A failed GPC's memory contents can be
dumped by powering ON, switching the computer to
TERMINATE and HALT,
and then selecting the number of the failed GPC on the GPC MEMORY

DUMP
rotary switch on panel M042F. The GPC is then moded to STBY to start the
dump. After 2 to 8 minutes, the dump is stopped by moding the GPC to HALT and the output to NORM.
This process is referred to as a hardware-initiated, standalone memory (HISAM)
GPC memory dump.

2. Payload data buses that tie the GPCs to the
payload MDMs and the payload data interleaver (PDI), and possibly
mission-dependent flex MDMs or sequence control assemblies

3. Launch data buses that tie the GPCs to ground
support equipment, launch forward, launch aft, launch mid, and SRB MDMs, and the
manipulator controller interface unit (MCIU) used by the remote manipulator
system

Although all data buses in each group except the
instrumentation/PCMMU buses are connected to all five GPCs, only one GPC at a
time transmits commands over each bus. However, several GPCs may receive data
from the same bus simultaneously.

Each data bus, with the exception of the
inter-computer communication data buses, is bidirectional; that is, data can
flow in either direction. The inter-computer communication data bus traffic
flows in only one direction (a PASS software constraint, not a hardware
restriction).

There are eight FC data buses directed into
groups of two, referred to as an FC string. Each FC string can be commanded by a
different GPC. Multiple units of each type of GNC hardware are wired to a
different MDM and flight-critical bus. FC1, 2, 3, and 4 connect the GPCs with
the four flight-critical forward (FF) MDMs, the four flight-critical aft (FA)
MDMs, the three display driver units, and the two headup displays. The other
four, FC5, 6, 7, and 8, connect the GPCs to the same four FF MDMs, the same four
FA MDMs, the two master events controllers, and the three main engine interface
units.

A string is composed of two FC data buses: one
from the first group (FC1, 2, 3, or 4) and one from the second group (FC5, 6, 7,
or 8). Vehicle hardware is segmented into these groups to facilitate GPC command
of these components for redundancy, to allow for nominal mission operations in
the event of a loss of one string caused by a GPC or MDM failure, and to allow
for safe return to Earth in the event of the loss of a second string.

String 1 consists of FC data buses 1 and 5, MDMs
FF1 and FA1 and their hard-wired hardware, controls, and displays, the three
engine interface units, the two master events controllers, the three display
driver units, head-up display 1, and their associated displays. This
distribution of hardware is fixed and cannot be changed. The other three strings
are defined in a similar manner.

During ascent and entry, when there are four PASS
GNC GPCs in the redundant set, each is assigned a different string to maximize
redundancy. All flight-critical hardware units are redundant, and the redundant
units are on different strings. The string concept provides failure protection
during dynamic phases by allowing exclusive command of a specific group of
vehicle hardware by one GPC, which can be transferred to another GPC in case of
failure. All or part of one string can be lost, and all avionics functions will
still be retained through the other strings.

With four PASS GNC GPCs in a redundant set, each
GPC is responsible for issuing commands over the string assigned to it; that is,
it is the commander of that string. The other GNC GPCs will monitor or listen on
this string. When the string's commanding GPC sends a request for data to the
hardware on the string, all the other GNC GPCs will hear and receive the same
data coming back on the string. This transaction (one commanding GPC and
multiple listening GPCs) is occurring in parallel with the other three strings.
Therefore, all GNC GPCs will get a copy of all of the data from all four
strings. Once all the data are received from the string, the GPCs then agree (or
disagree) that the data are consistent.

Two payload data buses interface the five GPCs
with the two payload MDMs (also called payload forward MDMs), which interface
with orbiter systems and payloads. A PDI is connected to payload data bus 1.
Additionally, on some flights, one or two flex MDMs and/or sequence control
assemblies connect the payload data buses to communicate with other payload
equipment.

Each payload MDM is connected to two payload data
buses. Safety-critical payloadstatus parameters may
be hard-wired; then these parameters and others can be recorded as part of the
vehicle's system management, which is transmitted and received over two payload
buses. To accommodate the various forms of payload data, the PDI integrates
payload data for transmission to ground telemetry. PDI configuration commands
and status monitoring is accomplished via payload data bus 1.

Two launch data buses are used primarily for
ground checkout and launch phase activities. They connect the five GPCs with the
ground support equipment/launch processing system, the launch forward (LF1),
launch mid (LM1), and launch aft (LA1) MDMs aboard the orbiter, and the two left
and right SRB MDMs (LL1, LL2, LR1, and LR2). Launch data bus 1 is used on orbit
for interface with the remote manipulator system controller by the SM GPC.

Each of two MMUs interfaces with its data bus via
a multiplexer interface adapter, which functions just like the ones in the GPCs.
Each data bus is connected to all five GPCs. Each MMU is connected to only one
mass memory data bus. In addition, each MMU has a separate discrete line called
the "ready discrete" that goes to each of the GPCs. If the discrete is on, it
tells the GPC the mass memory unit is ready for a transaction. When the discrete
is off, the MMU is either busy with another transaction or is powered off.

Note that all MMU operations and transmissions to
the GPCs are on an on-demand basis only. There is no insight into the state of
the MMU (other than the ready discrete) unless a specific transaction is
requested. This includes the status of the MMU's built-in test equipment (BITE),
which is only updated for MMU read or write.

The four display electronics unit keyboard (DK)
data buses, one for each display electronics unit, are connected to each of the
five GPCs. The computer in command of a particular display/keyboard data bus is
a function of the current

MAJOR FUNC switch setting of the
associated CRT, current memory configuration, GPC/CRT keyboard entries, and the
position of the backup flight control CRT switches. (These topics are discussed
in more detail under "Operations.")

The five instrumentation/PCMMU data buses are
unique in that each GPC has its own individual data bus to two PCMMUs. All the
other data buses interface with every GPC. Flight controllers monitor the status
of the vehicle's onboard systems through data transmissions from the vehicle to
the ground. These transmissions, called downlink, include GPC-collected data,
payload data, instrumentation data, and onboard voice. The GPC-collected data,
called down-list, includes a set of parameters chosen before flight for each
mission phase.

The system software in each GPC assimilates the
specified GNC, systems management, payload, or DPS data according to the
premission defined format for inclusion in the down-list. Each GPC is physically
capable of transmitting its down-list to the current active PCMMU over its
dedicated instrumentation/PCMMU data bus. Only one PCMMU is powered at a time.
It interleaves the down-list data from the different GPCs with the
instrumentation and payload data according to the telemetry format load
programmed in the PCMMU. The resulting composite data set, called the
operational downlink, is transmitted to one of two network signal processors (NSPs).
Only one NSP is powered at a time. In the NSP, the operational downlink is
combined with onboard recorded voice for transmission to the ground. The S-band
and Ku-band communications systems transmit the data either to the space flight
tracking and data network remote site ground stations or through the Tracking
and Data Relay Satellite (TDRS) system to Mission Control.

Uplink is the method by which ground commands
originating in Mission Control are formatted, generated, and transmitted to the
orbiter for validation, processing, and eventual execution by onboard software.
This capability allows ground systems to control data processing, change modes
in orbiter hardware, and store or change software in GPC memory and mass memory.

From Mission Control consoles, flight controllers
issue commands and request uplink. The command requests are formatted into a
command load for transmission to the orbiter either by the STDN sites or by the
TDRS system. The S-band or Ku-band transponder receivers aboard the orbiter send
the commands to the active NSP. The NSP validates the commands and, when they
are requested by the GPCs through a flight-critical MDM, sends them on to the
GPC. The GPCs also validate the commands before executing them. Those GPCs
listening directly to the flight-critical data buses then forward uplink
commands for those GPCs not listening to the FC buses over the intercomputer
communication data buses.

The PCMMU also contains a programmable read-only
memory for accessing subsystem data, a random-access memory in which to store
data, and a memory in which GPC data are stored for incorporation into the
downlink. To prevent the uplink of spurious commands from somewhere other than
Mission Control, the flight crew can control when the GPCs accept uplink
commands, and when uplink is blocked. The

GPC BLOCK
position of
the UPLINK switch on panel C3 inhibits uplink commands during ascent and
entry when the orbiter is not over a ground station or in TDRS coverage.

All GPCs processing PASS software exchange status
information over the IC data buses. During launch, ascent, and entry, GPCs 1, 2,
3, and 4 are usually assigned to perform GNC tasks, operating as a redundant
set, with GPC 5 as the backup flight system. Each of the PASS GPCs acts as a
commander of a given IC data bus and initiates all data bus transactions on that
data bus.

The four PASS GPCs are loaded with the same
software. Interconnecting the four IC buses to the four PASS GPCs allows each
GPC access to the status of data received or transmitted by the other GPCs so
that identical results among the four PASS GPCs can be verified. Each IC bus is
assigned to one of the four PASS GPCs in the command mode, and the remaining
GPCs operate in the listen mode for the bus. Each GPC can receive data from the
other three GPCs, pass data to the others, and perform any other tasks required
to operate the redundant set.

The MDMs convert and format (demultiplex) serial
digital GPC commands into separate parallel discrete, digital, and analog
commands for various vehicle hardware systems. The MDMs also convert and format
(multiplex) the discrete, digital, and analog data from vehicle systems into
serial digital data for transmission to the GPCs. Each MDM has two redundant
multiplexer interface adapters (MIAs), each connected to a separate data bus.
The MDM's other functional interface is its connection to the appropriate
vehicle system hardware by hardwired lines.

There are 20 MDMs aboard
the orbiter; 13 arepart of the DPS, connected directly to the GPCs and
named and numbered according to their location in the vehicle and hardware
interface. The remaining seven MDMs are part of the vehicle instrumentation
system and send vehicle instrumentation data to the PCMMUs. (They are termed
operational instrumentation (OI) MDMs.)

The DPS MDMs consist of flight-critical forward
(FF) MDMs 1 through 4, flight-critical aft (FA) MDMs 1 through 4, payload (PL)
MDMs 1 and 2, and GSE/LPS launch forward (LF1), launch mid (LM1), and launch aft
(LA1). One or two flex MDMs (FMDMs) may also be connected to the PL data buses,
depending on the payload needs for a particular flight.

Of the seven operational instrumentation MDMs,
four are located forward (OF1, OF2, OF3, and OF4), and three are located aft
(OA1, OA2, and OA3). Also recall, there are four SRB MDMs; i.e., SRB launch left
(LL) MDMs 1 and 2 and launch right (LR) MDMs 1 and 2.

The system software in the redundant set GPC
activates a GNC executive program and issues commands to authorized buses and
MDMs to request a set of input data. Each MDM receives the command from the GPC
assigned to command it, acquires the requested data from the GNC hardware wired
to it, and sends the data to the GPCs.

Each FC data bus is connected to a flight
forward and flight aft MDM. Each MDM has two MIAs, or ports, and each port has a
channel through which the GPCs can communicate with an MDM; however, the GPCs
can interface on the FC data buses with only one MIA port at a time. Port moding
is the software method used to control the MIA port that is active in an MDM.
Initially, these MDMs operate with port 1; if a failure occurs in port 1, the
flight crew can select port 2. Since port moding involves a pairof buses, both
MDMs must be port moded at the same time. The control of all other units
connected to the affected data buses is unaffected by port moding. Port moding
is a software-only process and does not involve any hardware changes.

Payload data bus 1 is connected to the primary
MIA port of payload MDM 1, and payload data bus 2 is connected to the primary
port of payload MDM 2. Payload data bus 1 is connected to the secondary MIA port
of payload MDM 2, and payload data bus 2 is connected to the secondary port of
payload MDM 1. Which bus is used to communicate with each MDM is controlled by
port moding.

The two launch data buses are also connected to
dual launch MDM multiplexer interface adapter ports. The flight crew cannot
switch these ports; however, if an input/output error is detected on LF1 or LA1
during prelaunch, an automatic switchover occurs.

The hardware controls for the MDMs are the
MDM
PL1, PL2,
PL3, FLT CRIT AFT, and FLT CRIT FWD power switches on panel O6. These
ON/OFF switches provide or remove power for the four aft
and four forward flight-critical MDMs and PL1 and PL2 MDMs. The PL3
switch is unwired and is not used. There are no flight crew controls for the
SRB MDMs.

Each MDM is redundantly powered by two main
buses. The power switches control bus power for activation of a remote power
controller (RPC) for each main power bus to an MDM. The main buses power
separate power supplies in the MDM. Loss of either the main bus or MDM power
supply does not cause a loss of function because each power supply powersboth channels in the MDM. Turning off power to an MDM resets all the
discrete and analog command interfaces to subsystems.

The SRB MDMs receive power through SRB buses A
and B; they are tied to the orbiter main buses and are controlled by the master
events controller circuitry. The launch forward, mid, and aft MDMs receive their
power through the preflight test buses.

The FF, PL, LF, and LM MDMs are located in the
forward avionics bays and are cooled by water coolant loop cold plates. LA and
FA MDMs are in the aft avionics bays and are cooled by Freon coolant loop cold
plates. MDMs LL1, LL2, LR1, and LR2 are located in the SRBs and are cooled by
passive cold plates.

Module (or card) configuration in an MDM was
dictated by the hardware components to be accessed by that type of MDM. A
flight-critical forward and aft MDM are not interchangeable. However,
flight-critical MDMs of the same type may be interchanged with another and the
payload MDMs may be interchanged. Each MDM is 13 by 11 by 7 inches and weighs
about 38.5 pounds. MDMs use less than 80 watts of power.

Enhanced MDMs (EMDMs) were installed in OV 105.
EMDMs will be installed in the other vehicles only as MDMs require replacement.
The presence of EMDMs is transparent to the crew except in the case of an MDM
OUTPUT message. With MDMs, the message means there is a problem with an MDM or a
GPC. An MDM OUTPUT message with EMDMs means it is most likely a GPC problem.
Crews flying with a combination of MDMs and EMDMs will receive assistance from
flight controllers in interpreting an MDM OUTPUT message.

There are two mass memory units (MMUs) aboard the
orbiter. Each is a coaxially mounted, reel-to-reel read/write digital magnetic
tape storage device for GPC software and orbiter systems data.

Computing functions for all mission phases
requires approximately 600,000 half-words of computer memory. The orbiter GPCs
are loaded with different memory configurations from the MMUs. In this way,
software can be stored in MMUs and loaded into the GPCs when actually needed.

To fit the required software into the available
GPC memory space, programs are subdivided into eight memory configurations
corresponding to functions executed during specific flight and checkout phases.
Thus, in addition to the central memory in the GPCs themselves, 34 million bytes
of information can be stored in each of the two MMUs. Critical programs and data
are loaded in both MMUs and protected from erasure.

The principal function of the MMU, besides
storing the basic flight software, is to store background formats and code for
certain CRT displays and the checkpoints that are written periodically to save
selected data in case the systems management GPC fails.

Operations are controlled by logic and the read
and write electronics that activate the proper tape heads (read or write/erase)
and validate the data.

Each MMU interfaces with its mass memory data bus
through MIAs that function like the ones in the GPCs. Each mass memory data bus
is connected to all five computers; however, each MMU is connected to only one
mass memory data bus. All MMU operations are on an on-demand basis only.

The power switches are located on panel O14 for
MMU 1 and panel O15 for MMU 2. The

MMU 1
switch on panel O14
positioned to ON allows control bus power to activate an RPC, which allows MNA
power to MMU 1. The MMU 2 switch on panel O15 positioned to ON operates in a similar
manner with MNB power. An MMU uses 20 watts of power in standby and 70 watts
when the tape is moving.

MMU 1 is located in crew compartment middeck
avionics bay 1, and MMU 2 is in avionics bay 2. Each unit is cooled by water
coolant loop cold plates. Each MMU is 7.6 inches high, 11.6 inches wide and 15
inches long and weighs 25 pounds.

The multifunction CRT display system allows
onboard monitoring of orbiter systems, computer software processing, and manual
control for flight crew data and software manipulation. The system is composed
of three types of hardware: four display electronics units (DEUs), four display
units (DUs) or CRTs, and three keyboard units, which together communicate with
the GPCs over the display/keyboard data buses.

The system provides almost immediate response to
flight crew inquiries through displays, graphs, trajectory plots, and
predictions about flight progress. The crew controls the vehicle system
operation through the use of keyboards in conjunction with the display units.
The flight crew can alter the system configuration, change data or instructions
in GPC main memory, change memory configurations corresponding to different
mission phases, respond to error messages and alarms, request special programs
to perform specific tasks, run through operational sequences for each mission
phase, and request specific displays.

Three identical keyboards are located on the
flight deck: one each on the left and right sides of the flight deck center
console (panel C2) and one on the flight deck at the side aft flight station
(panel R11L). Each keyboard consists of 32 momentary double-contact pushbutton
keys. Each key uses its double contacts to permit communication on separate
signal paths to two DEUs. Only one set of contacts on the aft station keys is
actually used because this keyboard is wired to communicate with only the aft
display electronics unit.

There are 10 number keys, six letter keys (used
for hexadecimal inputs), two algebraic keys, a decimal key, and 13 special
function keys. Using these keys, the flight crew can ask the GPC more than 1,000
questions about the mission and condition of the vehicle. (Keyboard operations
are discussed in detail later in this section.)

Each of the four DEUs responds to computer
commands, transmits data, executes its own software to process keyboard inputs,
and sends signals to drive displays on the CRTs (or display units). The units
store display data, generate the GPC/keyboard unit and GPC/display unit
interface displays, update and refresh on-screen data, check keyboard entry
errors, and echo keyboard entries to the CRT.

There are three CRTs on flight deck forward
display and control panel F7 and one at the side aft flight deck station on
panel R11L. Each CRT is 5 by 7 inches.

The display unit uses a magnetic-deflected,
electrostatic-focused CRT. When supplied with deflection signals and video
input, the CRT displays alphanumeric characters, graphic symbols, and vectors on
a green monochrome phosphorous screen activated by a magnetically controlled
beam. Each CRT has a brightness control for ambient light and flight crew
adjustment.

The DEUs are connected to the display/keyboard
data buses by MIAs that function like those of the GPCs. Inputs to the DEU are
from a keyboard or a GPC.

Positioning the

DISPLAY ELECTRONICS
UNIT 1, 2, 3, 4 switches on panel O6 to LOAD initiates a GPC request for a
copy of DEU software stored in mass memory before operations begin. If the GPC
software in control of the CRT is designed to support a DEU load (or IPL)
request, then information is sent from the mass memory to the GPC and then
loaded from the GPC into the DEU memory.

It is possible to do in-flight maintenance and
exchange CRT 4 with CRT 1 or 2. CRT 3 cannot be changed out because of interface
problems with the orbiter jettison T-handle. Also, either individual keys or the
entire forward keyboard can be replaced by the aft keyboard. The DEUs are
located behind panels on the flight deck. DEUs 1 and 3 are on the left, and DEUs
2 and 4 are on the right. DEU 4 can replace any of the others; however, if DEU 2
is to be replaced, only the cables are changed because 2 and 4 are next to each
other.

The display electronics units and display units
are cooled by the cabin fan system. The keyboard units are cooled by passive
heat dissipation.

The GPC complex requires a stable, accurate time
source because its software uses Greenwich mean time (GMT) to schedule
processing. Each GPC uses the master timing unit (MTU) to update its internal
clock. The MTU provides precise frequency outputs for various timing and
synchronization purposes to the GPC complex and many other orbiter subsystems.
Its three time accumulators provide GMT and mission elapsed time (MET), which
can be updated by external control. The accumulator's timing is in days, hours,
minutes, seconds, and milliseconds up to 1 year.

The MTU is a stable, crystal-controlled frequency
source that uses two oscillators for redundancy. The signals from one of the two
oscillators are passed through signal shapers and frequency drivers to the three
GMT/MET accumulators.

The MTU outputs serial digital time data
(GMT/MET) on demand to the GPCs through the accumulators. The GPCs use this
information for reference time and indirectly for time-tagging GNC and systems
management processing. The MTU also provides continuous digital timing outputs
to drive the four digital timers in the crew compartment: two mission timers and
two event timers. In addition, the MTU provides signals to the PCMMUs, COMSECs,
payload signal processor, and FM signal processor, as well as various payloads.
The GPCs start by using MTU accumulator 1 as their time source. Once each
second, each GPC checks the accumulator time against its own internal time. If
the time is within tolerance (less than one millisecond), the GPC updates its
internal clock to the time of the accumulator, which is more accurate, and
continues. However, if the time is out of tolerance, the GPC will trythe other
accumulators and then the lowest numbered GPC until it finds a successful
comparison. The PASS GPCs do not use the MET that they receive from the master
timing unit because they compute MET on the basis of current GMT and lift-off
time.

The TIME display (SPEC 2) provides the capability
to observe the current MTU and GPC clock status, synchronize or update the MTU
and GPC clocks, and set CRT timers and alert tone duration and timers.

The MTU is redundantly powered by the ESS 1BC MTU
A and ESS 2CA MTU B circuit breakers on panel O13. The MASTER TIMING UNIT switch
on panel O6 controls the MTU. When the switch is in AUTO, and a time signal from
one oscillator is out of tolerance, the MTU automatically switches to the other
oscillator. For nominal operations, the MTU is using oscillator 2 with the
switch in AUTO. The OSC 1 or OSC 2 position of the switch manually selects
oscillator 1 or 2, respectively.

The MTU is located in crew compartment middeck
avionics bay 3B and is cooled by a water coolant loop cold plate. The hardware
displays associated with the master timing unit are the mission and event
timers. MISSION TIME displays are located on panels O3 and A4. They can display
either GMT or MET in response to the GMT or MET positions of the switch below
the displays. The forward EVENT TIME display is on panel F7, and it is
controlled by the EVENT TIME switches on panel C2. The aft EVENT TIME display is
on panel A4, and its EVENT TIME control switches are on panel A6U.

Primary Avionics Software System (PASS)
The PASS (also referred to as primary flight software) is the principal software
used to operate the vehicle during a mission. It contains all the programming
needed to fly the vehicle through all phases of the mission and manage all
vehicle and payload systems.

Since the ascent and entry phases of flight are so
critical, four of the five GPCs are loaded with the same PASS software and
perform all GNC functions simultaneously and redundantly. As a safety measure,
the fifth GPC contains a different set of software, programmed by a company
different from the PASS developer, designed to take control of the vehicle if a
generic error in the PASS software or other multiple errors should cause a loss
of vehicle control. This software is called the backup flight system (BFS). In
the less dynamic phases of on-orbit operations, the BFS is not required. The
information provided below describes how the PASS software relates to the DPS
and the crew.

Much of the material is common between PASS and
BFS; therefore, only BFS differences are discussed immediately after the PASS
discussion. DPS software is divided into two major groups, system software and
applications software. The two groups are combined to form a memory
configuration for a specific mission phase. The programs are written in HAL/S
(high-order assembly language/shuttle) specifically developed for real-time
space flight applications.

System software is the GPC operating system
software that controls the interfaces among the computers and the rest of the
DPS. It is loaded into the computer when it is first initialized. It always
resides in the GPC main memory and is common to all memory configurations. The
system software controls GPC input and output, loads new memory configurations,
keeps time, monitors discretes into the GPCs, and performs many other DPS
operational functions.

The system software consists of three sets of
programs. The flight computer operating system (FCOS) (the executive) controls
the processors, monitors key system parameters, allocates computer resources,
provides for orderly program interrupts for higher priority activities, and
updates computer memory. The user interface programs provide instructions for
processing flight crew commands or requests. The system control program
initializes each GPC and arranges for multi-GPC operation during flight-critical
phases.

One of the system software functions is to manage
the GPC input and output operations, which includes assigning computers as
commanders and listeners on the data buses and exercising the logic involved in
sending commands to these data buses at specified rates and upon request from
the applications software.

The applications software performs the functions
required to fly and operate the vehicle. To conserve main memory, the
applications software is divided into three major functions:

Guidance, navigation, and control (GNC):
specific software required for launch, ascent to orbit, maneuvering in
orbit, entry, and landing. This is the only major function where redundant
set synchronization can occur.

Systems
management (SM): tasks that monitor various
orbiter systems, such as life support, thermal control, communications, and
payload operations. SM is a simplex major function; only one GPC at a time
can actively process an SM memory configuration.

Payload
(PL): this major function currently contains
mass memory utility software. The PL major function is usually unsupported in flight, which
means that none of the GPCs are loaded with PL software. It is only used in
vehicle preparation at KSC, and is also a simplex major function. Note that
software to support payload operations is included as part of the SM GPC
memory configuration.

Major functions are divided into mission phase
oriented blocks called operational sequences (OPS). Each OPS of a major function
is associated with a particular memory configuration that must be loaded
separately into a GPC from the MMUs. Therefore, all the software residing in a
GPC at any given time consists of system software and an OPS major function;
i.e., one memory configuration. Except for memory configuration 1, each memory
configuration contains one OPS. Memory configuration 1 is loaded for GNC at
launch and contains both OPS 1 (ascent) and OPS 6 (RTLS), since there would be
no time to load in new software for a return to launch site (RTLS) abort.

During the transition from one OPS to another,
called an OPS transition, the flight crew requests a new set of applications
software to be loaded in from the MMU. Every OPS transition is initiated by the
flight crew. When an OPS transition is requested, the redundant OPS overlay
contains all major modes of that sequence.

Major modes are further subdivisions of an OPS,
which relate to specific portions of a mission phase. As part of one memory
configuration, all major modes of a particular OPS are resident in GPC main
memory at the same time. The transition from one major mode to another can be
automatic (e.g., in GNC OPS 1 from pre-count MM 101 to first stage MM 102 at
lift-off) or manual (e.g., in SM OPS 2 from on-orbit MM 201 to payload bay door
MM 202 and back).

Each major mode has an associated CRT display,
called a major mode display or OPS display, that provides the flight crew with
information concerning the current portion of the mission phase and allows
flight crew interaction. There are three levels of CRT displays. Certain
portions of each OPS display can be manipulated by flight crew keyboard input
(or ground link) to view and modify system parameters and enter data. The
specialist function (SPEC) of the OPS software is a block of displays associated
with one or more operational sequences and enabled by the flight crew to monitor
and modify system parameters through keyboard entries. The display function
(DISP) of the OPS software is a group of displays associated with one or more
OPS. These displays are for parameter monitoring only (no modification
capability) and are called from the keyboard. Display hierarchy and usage are
described in detail later in this section.

Even though the four PASS GPCs control all GNC
functions during the critical phases of the mission, there is always a
possibility that a generic software failure could cause loss of vehicle control.
Therefore, the fifth GPC is loaded with the BFS software. To take over control
of the vehicle, the BFS monitors the PASS GPCs to keep track of the current
state of the vehicle. If required, the BFS can take over control of the vehicle
upon the press of a button. The BFS also performs the SM functions during ascent
and entry because the PASS GPCs are all operating in GNC. BFS software is always
loaded into GPC 5 before flight, but any of the five GPCs could be made the BFS
GPC if necessary.

Since the BFS is intended to be used only in a
contingency, its programming is much simpler than that of the PASS. Only the
software necessary to complete ascent or entry safely, maintain vehicle control
in orbit, and perform SM functions during ascent and entry is included. Thus,
all the software used by the BFS can fit into one GPC and never needs to access
mass memory. For added protection, the BFS software is loaded into the MMUs in
case of a BFS GPC failure and the need to IPL a new BFS GPC.

The BFS, like PASS, consists of system software
and applications software. System software in the BFS performs basically the
same functions as it does in PASS. These functions include time management,
PASS/BFS interface, multifunction CRT display system, input and output, uplink
and downlink, and engage and disengage control. The system software is always
operating when the BFS GPC is not in

HALT.

Applications software in the BFS has two different major
functions, GNC and systems management, but all its applications software resides
in main memory at one time, and the BFS can process software in both major
functions simultaneously. The GNC functions of the BFS, designed as a backup
capability, support the ascent phase beginning at MM 101 and the de-orbit/entry
phase beginning at MM 301. In addition, the various ascent abort modes are
supported by the BFS. The BFS provides only limited support for on-orbit
operations via MM 106 or MM 301. Because the BFS is designed to monitor
everything the PASS does during ascent and entry, it has the same major modes as
the PASS in OPS 1, 3, and 6.

The BFS SM
contains software to support the ascent and entry phases of the mission.
Whenever the BFS GPC is in the RUN or STBY mode, it runs
continuously; however, the BFS does not control the payload buses in STBY.
The SM major function in the BFS is not associated with any operational sequence
and is always available whenever the BFS is active.

Even though the
five general-purpose computers and their switches are identical, the GENERAL
PURPOSE COMPUTER MODE switch on panel O6 works differently for a GPC loaded
with BFS. Since HALT is a hardware controlled state, no software is
executed. The STBY mode in the BFS
GPC is totally different from its corollary in the PASS GPCs. When the BFS GPC
is in STBY, all normal software is executed as if the BFS were in
RUN; the only difference is that BFS command of the payload data buses is
inhibited in STBY. The BFS is normally put in
RUN for ascent and
entry, and in STBY whenever a
PASS systems management GPC is
operating. If the BFS is engaged while the MODE
switch is in STBY
or RUN, the BFS takes control of the flight-critical and payload data
buses. The MODE talkback indicator on panel O6 indicates RUN if the BFS
GPC is in RUN or
STBY and displays
barberpole if the BFS is in HALT or has failed.

Pre-engage, the BFS is synchronized with the PASS
set using flight-critical I/O so that it can track the PASS and keep up with its
flow of commands and data. Synchronization and tracking take place during OPS 1,
3, and 6. During this time, the BFS listens over the flight critical data buses
to the requests for data by PASS and to the data coming back. The BFS depends on
the PASS GPCs for acquisition of all its GNC data and must be synchronized with
the PASS GPCs so that it will know when to receive GNC data over the FC buses.
When the BFS is in sync and listening to at least two strings, it is said to be
tracking PASS. As long as the BFS is in this mode, it maintains the currentstate vector and all other information necessary to fly the vehicle in
case the flight crew needs to engage it. When the BFS GPC is tracking the PASS
GPCs, it cannot command over the FC buses but may listen to FC inputs through
the listen mode. The BFS uses the MTU (like PASS) and keeps track of GMT over
the flight-critical buses for synchronization. The BFS also monitors some inputs
to PASS CRTs and updates its own GNC parameters accordingly.

The BFS GPC controls its own
instrumentation/PCMMU data bus. The BFS GPC requirements strictly forbid use of
the IC data bus to monitor or to transmit status or data to the other GPCs. The
mass memory data buses are not used except during initial program load, which
uses the same IPL SOURCE switch on panel O6 as used for PASS IPL.

The BFC lights on panels F2 and F4 remain
unlighted as long as PASS is in control, and the BFS is tracking. The lights
flash if the BFS loses track of the PASS and goes standalone. The flight crew
must then decide whether to engage the BFS or try to initiate BFS tracking again
by an I/O RESET on the keyboard. When BFS is engaged and in control of the
flight-critical buses, the BFC lights are illuminated and stay on until the BFS
is disengaged.

Since the BFS does not operate in a redundant
set, its fail votes from and against other GPCs are not enabled; thus, the

GPC STATUS light matrix on panel O1 for the BFS GPC does not
function as it does in PASS. The BFS can illuminate its own light on the GPC
STATUS matrix if
the watchdog timer in the BFS GPC times out when the BFS GPC does not complete
its cyclic processing.

To engage the BFS, which is considered a
last resort to save the vehicle, the crew presses a

BFS ENGAGE momentary
pushbutton located on the commander's and pilot's rotational hand controllers (RHCs).
As long as the RHC is powered, and the appropriate OUTPUT switch on panel O6 is in BACKUP,
depressing the ENGAGE
pushbutton on either RHC engages the BFS and causes PASS to relinquish control.
There are three contacts in each ENGAGE pushbutton, and
all three contacts must be made to engage the BFS. The signals from the RHC are
sent to the backup flight controller, which handles the engagement logic.

When the BFS
is engaged, the BFC lights on panels F2 and F4 are steadily illuminated, the
BFS's OUTPUT talkback
indicator on panel O6 turns gray, all PASS GPC
OUTPUT and MODE talkback indicators on panel O6 display
barberpole, the BFS controls the CRTs selected by the BFC CRT SELECT switch on panel C3, big X and poll fail appear on the
remaining PASS controlled CRTs, and all four GPC
STATUS matrix diagonal indicators
for PASS GPCs are illuminated on panel O1.

When the BFS is not engaged, and the BFC CRT DISPLAY switch on
panel C3 is positioned to ON, the BFS commands the first CRT indicated by the
BFC CRT SELECT switch.
The BFC CRT SELECT
switch positions on panel C3 are 1 + 2,
2 + 3, and 3+1.
When the BFS is engaged, it assumes control of the second CRT as well.

If the BFS
is engaged during ascent, the PASS GPCs can be recovered on orbit to continue a
normal mission. This procedure takes about 2 hours, since the PASS inertial
measurement unit reference must be reestablished. The BFS is disengaged after
all PASS GPCs have been hardware-dumped and reloaded with PASS software.
Positioning the BFC DISENGAGE switch on panel F6 to the UP
position disengages the BFS. The
switch sends a signal to the BFCs that resets the engage discretes to the GPCs.
The BFS then releases control of the flight-critical buses as well as the
payload buses if it is in STBY,
and the PASS GPCs assume command.

After disengagement, the PASS and BFS GPCs
return to their normal pre-engaged states. Indications of the PASS engagement
and BFS disengagement are as follows: BFC lights on panels F2 and F4 are out,
BFS's OUTPUT talkback on panel O6 displays barberpole, all PASS
OUTPUT talkback indicators on panel O6 are gray, and BFS releases
control of one of the CRTs.

If the BFS is engaged, there is no manual thrust
vector control or manual throttling capability during first- and second-stage
ascent. If the BFS is engaged during entry, the speed brake can be positioned
using the speed brake/throttle controller, and the body flap can be positioned
manually. Control stick steering (CSS) by either the commander or pilot is
required during entry.

Pre-engage, the BFS supplies attitude errors on
the CRT trajectory display, whereas PASS supplies attitude errors to the
attitude director indicators; however, when the BFS is engaged, the errors on
the CRT are blanked, and attitude errors are supplied to the attitude director
indicators.

The crew interfaces with the five GPCs via four
CRTs and various dedicated display instruments. This section first discusses
crew operations using PASS, and then discusses crew operations using the BFS.

Switches on panel C2 designate which keyboard
controls each forward display electronics unit. When the LEFT CRT SEL switch is
positioned to 1, the left keyboard controls the left CRT 1; if the switch is
positioned to 3, the left keyboard controls the center CRT 3. When the

RIGHT CRT SEL switch on panel C2 is positioned to 2, the right keyboard
controls the right CRT 2; if positioned to 3, it controls the center CRT 3.
Thus, flight crew inputs are made on the
keyboards, and data are output from the GPCs on the CRT displays.

NOTE

If the LEFT
CRT SEL and RIGHT CRT
SEL

switches are both positioned to 3, keystrokes from both keyboards are
interleaved.

The aft station panel R11L keyboard is connected
directly to the aft panel R11L display electronics unit and CRT (or DU); there
is no select switch.

Each CRT has an associated power switch. The

CRT 1 POWER switch on panel C2 positioned to STBY or ON allows control bus
power to activate remote power controllers and sends MN A power to CRT 1. The
STBY position warms up the CRT filament, only. The ON position provides high
voltage to the CRT. The CRT 2 POWER switch on panel C2 functions the same
as the CRT 1 switch, except that CRT 2 is powered from MN B. The
CRT 3
POWER switch on panel C2 functions the same as the
CRT 1 switch,
except that CRT 3 is powered from MN C. The CRT 4 POWER
switch on panel
R11L functions the same as the CRT 1 switch, except that CRT 4 is
powered from MN C. The respective keyboards receive 5 volts of ac power to
illuminate the keys. Each DEU/DU pair uses about 290 watts of power when on and
about 20 watts in standby.

NOTE

Crewmembers should always check that keyboard
information is accepted on the proper CRT prior to executing the item.

Each CRT has an associated

MAJ FUNC switch. The CRT 1, 3,
2, MAJ FUNC switches on panel C2 tell the
GPCs which of the different functional software groups is being processed by the
keyboard units and what information is presented on the CRT. The CRT 4 MAJ FUNC switch on panel R11L functions in the same manner. This
three-position toggle switch allows the crew access to the GNC, SM, or PL software on a desired CRT.
The GPC loaded with the desired major function applications software will then
drive this CRT. Each major function accesses an independent set of display data
and functional software.

CRT display organization consists of three levels
of crew software displays within any given major function. The display types
parallel the different types of modules used in the GPC software. The
established display hierarchy within applications software is operational
sequences (OPS), specialist functions (SPEC), and display (DISP) functions. Each
has a type of CRT page associated with it.

The OPS is the highest level of crew software
control within a major function. Each memory configuration contains one or more
OPS. Each OPS allows the crew to accomplish an associated mission phase task.
Several operational sequences are defined, each covering some portion of the
mission. For example, OPS 1 contains ascent software, OPS 2 contains on-orbit
software, and OPS 3 contains entry software.

Each operational sequence is further divided into
major modes. Each major mode has an associated display that allows direct crew
interface with the software. These are OPS pages, and are also referred to as
major mode pages.

Specialist functions (SPECs) are second in the
hierarchy. A SPEC allows crew execution of other activities in conjunction with
a particular OPS. SPEC displays, like major mode displays, allow direct crew
interface with the software. Each SPEC has an associated display that will
overlay the major mode display when called. When a SPEC is called, its display
rolls in on top of the major mode display, which is still activeunderneath. The SPEC provides access to an associated portion of the
software located in the GPC. Some SPECs are contained in systems software,
whereas others are resident in the applications load. A SPEC can be associated
with a major function or an OPS, but thesystems
software SPECs can be obtained in most OPS and major functions. (The list of
SPECs and their availability can be found in the DPS Dictionary.)

Display functions (DISPs) are the lowest level of
software. Each DISP has an associated display that presents the status of a
predefined set of parameters. Unlike major mode displays or SPECs, a DISP cannot
initiate a change in software processing because DISP displays do not permit
direct crew interface with the software. They provide information only. When
called, a DISP will overlay the major mode display and the SPEC, if one is
active. Both the SPEC and the major mode display are overlaid, and access to
them can be easily regained. The method of terminating the processing of SPECs
and DISPs will be discussed later.

Each keyboard is composed of a 4 x 8 matrix of 32
pushbutton keys. This matrix consists of:

Sixteen alphanumeric keys: 0 through 9 and A
through F, for a hexadecimal numbering system

Two sign keys (+ and -) serving the dual
roles of sign indicators and delimiters. A delimiter is used to separate
discrete keyboard entries from their associated data.

One decimal point key for use in entering
data with decimal notation

Thirteen special function keys: some of these
keys are single stroke commands, and some are keys that start or finish a
multi-stroke command sequence. A key that starts a command sequence is a
command initiator and requires a command terminator key to be depressed to
tell the DEU the keyboard entry is complete.

ACKacknowledges receipt of a fault message on the fault
message line by causing the message to become static and by extinguishing the SM
ALERT light and software-controlled tones. If multiple messages are indicated on
the CRT, each subsequent press of the ACK key will bring up the next oldest
unacknowledged message and clear out the last acknowledged one.

MSG RESET
operates as a single keystroke command that clears both the currently
annunciated fault message and the buffer message indicator (if any) from the
fault message line. The fault message line
is the second to the last line on the CRT. Depressing this key will also
extinguish all software-driven caution and warning annunciators, software
controlled tones, and the SM ALERT light. An ILLEGAL ENTRY message can only be
cleared with the MSG RESET key.

SYS SUMMis
used to invoke the SYS SUMM display. The particular display called is determined
by the selected major function and active OPS.

FAULT SUMMis
used to invoke the FAULT display. It operates as a single keystroke command. The
FAULT display can be accessed in every major function and OPS.

GPC/CRTinitiates a
multi-stroke keyboard entry, allowing the selection of a particular GPC to drive
a DEU/DU set.

I/O RESET
attempts to restore a GPC's input/output configuration to its original status
prior to any error detection. It is a command initiator and requires a
terminator keystroke.

ITEMis used
as a multi-keystroke command initiator for changing the value of defined
parameters or implementing configuration changes on a given display (OPS or
SPEC).

EXECacts as a
multi-keystroke terminator to command the execution of the action specified on
the scratch pad line. It is the terminator for the initiators above it (GPC/CRT,
I/O RESET, and ITEM keys). EXEC may also be a single keystroke command to enable
an OMS burn.

OPSserves as a multi-keystroke initiator to load a desired OPS load from mass
memory into one or more GPCs. It is also used to transition from major mode to
major mode within an OPS.

SPECacts as a
multi-keystroke initiator to select a defined SPEC or DISP display within a
given OPS. In addition, this key provides the capability to freeze a display on
the CRT. A single depression of the SPEC key freezes the display so it may be
statically viewed. The display will remain frozen until another key (other than
ACK, MSG RESET, or another SPEC) is entered.

PRO(Proceed)
serves as a terminator to the OPS and SPEC keys. The completed command sequence
initiates the selection of a desired OPS, SPEC, or DISP display.

RESUMEis used
to terminate a displayed SPEC or DISP. CRT control is restored to the underlying
display upon depression of this key.

CLEARclears
the last echoed keystroke from the bottom line (scratch pad line) of the CRT.
For each depression, one additional keystroke is removed, proceeding from right
to left. After a command sequence is completed, a single depression of the CLEAR
key will erase the static command from the scratch pad line.

The crew can select a variety of CRT displays.
Some of the different ways to select an OPS display and its available SPEC and
DISP displays are as follows:

Selection of the major function is done by
placing the MAJ FUNC switch (on panel C2) associated with the CRT in use in the
GNC, SM, or PL position.

An OPS
is loaded from the MMU via a three-step keyboard entry. A new OPS is called from
mass memory by its first major mode. The OPS is loaded into the GPC that is
currently driving the DEU/DU on which the keyboard entry is done. Once the OPS
is loaded, access is provided to major modes in that OPS. Major mode displays
are advanced by the same keyboard command. The steps for selecting an OPS display
are as follows:

1.
Depress the OPS key.

2. Key
in the three numbers of the desired OPS.
The first digit defines the OPS and the next two digits specify the major mode.

3.
Depress the PRO key. Once the OPS is loaded
into one or more GPCs, that software can be accessed at any time through any CRT
in the proper major function.

Transitions from major mode to major mode or to
another OPS are accomplished by either automatic transitions or proper command
entry.

Automatic transitions: Some major mode
transitions occur automatically, usually as a function of some mission
event. Examples of automatic transitions are between major modes 101 and 102
(SRB ignition) and between major modes 102 and 103 (SRB separation).
Selection of an RTLS abort also results in an automatic OPS transition.

Command entry: Proper command entry (OPS XXX
PRO) is almost always used to transition from one OPS to another. In most
cases, it is also a legal transition operation for proceeding from one major
mode to the next (e.g.; 301 to 302).

Certain rules have been established for
proceeding from one display to another. These can be categorized into treatment
of proper display sequencing, the overlaying of current displays by new
displays, and the display retention hierarchy.

The hierarchy of overlaying SPECs and DISPs makes
sense if one remembers that a SPEC allows crew interaction and control of
specialized operations, whereas a DISP provides display information only. Both
SPECs and DISPs overlay the current major mode display when called.

A SPEC need not be previously selected in order
to call a DISP. If a DISP is on the CRT, andanother
SPEC or DISP is called, the current DISP is terminated. The terminated DISP can
only be viewed again by entering its calling command once more.

If a SPEC is selected, and a DISP is called to
overlay it, the SPEC is retained underneath the DISP. If another SPEC is then
selected, the underlying SPEC as well as the DISP over it is terminated. The
terminated SPEC can only be viewed again if it is recalled.

The RESUME key is used as a single keystroke
entry to terminate the SPEC or DISP currently being displayed and to restore the
underlying display. If the display being terminated is a DISP, CRT control will
be restored to the underlying SPEC, or to the OPS display if no SPEC has been
selected. If a SPEC display is terminated, CRT control is restored to the major
mode display. It is advisable to press RESUME after viewing any SPEC or DISP to
avoid confusion and to decrease the possibility of attempting to retain more
SPEC displays than the software allows. Also, certain ground command functions
may not be possible when corresponding SPECs are active or underlying a DISP.
The RESUME key cannot be used to transition from one major mode display to
another or to page backwards through major mode displays.

Major mode transitions: Both SPECs and DISPs
are retained during a major mode transition. If a SPEC or DISP is overlaying
the major mode display, the new major mode display can't be seen until the
overlaying displays are terminated with the RESUME key.

Major function change: OPS and SPEC displays
on the CRT screen are retained within their major function when major
function positions are switched. When the crew returns to the first major
function, the SPEC last viewed will appear on the screen. Depression of the
RESUME key will restore the underlying OPS. If no SPEC had been selected,
return to a major function would restore the last major mode display. DISP
displays are not retained at major function switch transitions.

OPS transition: SPECs, DISPs, and major mode
displays are not retained through an OPS transition, since this involves
loading an entirely new module of applications software in the GPC. The
SPECs may be called again if they are available in the new OPS.

Two discrete brightness intensities for displayed
characters are designated "bright" and "over-bright." The bulk of all material
is displayed in the "bright" intensity. Special messages and special characters,
such as parameter status indicators, are displayed in "over-bright" to direct
the crew's attention during their display scan.

Certain words and messages are designed toflash on and off. Fault messages will flash, indicating a message that
needs to be acknowledged. Command initiators are designed to flash until the
command is completed, and an incorrect keyboard entry will result in a flashing
"ERR" to the right of the erroneous entry.

OPS number:
The four-digit field in the upper left corner of the first line designates the
number of the OPS display being processed. The first digit represents the OPS;
the next two digits indicate the major mode. The last digit is always a "1," and
it is not used when making keyboard entries.

SPEC number:
Directly to the right of the OPS number is a three-digit field. This field
displays the number of the SPEC overlaying the OPS. This field is blank if no
SPEC is selected.

DISP number:
The last field in the upper left corner represents the DISP number. It is a
three-digit field. This field is blank if no DISP is currently being displayed.

Display title:
Centered on the top line of the display is the title of the display. Portions of
some titles are dynamic and will specify the mission phase.

Uplink indicator:
Directly to the right of the display title is a two-space field. When an uplink
to the GPC is in progress, a flashing "UL" will be displayed. Otherwise this
field is blank.

GPC driver: To
the right of the uplink indicator is a one-digit field. A number in this field
indicates the particular GPC (1, 2, 3, 4, or 5) that is commanding the CRT.

GMT/MET clock:
This field displays time in days, hours, minutes, and seconds (DDD/HH: MM:SS).
The field is updated every second. The time displayed may be either GMT or MET
selectable via a keyboard entry to the SPEC 2 TIME display.

CRT timer:
Directly below the GMT/MET clock is a CRT timer field also displayed in days,
hours, minutes, and seconds (DDD/HH:MM: SS). This field is also updated every
second, and can be set via a keyboard entry to the TIME SPEC display.

Fault message line:
The second line from the bottom is reserved for fault messages. Illegal keyboard
entry messages and systems fault messages are displayed on this line. In the
case of system faults, a number in parentheses to the far right on this line
indicates the number of fault messages that have not been viewed and
acknowledged (further discussion of fault messages is covered in a later
section).

Scratch pad line:
The bottom line of the display echoes keyboard entries made by the crew. Command
initiators (OPS, SPEC, ITEM, GPC/CRT, and I/O RESET) will flash on the scratch
pad line until the command is terminated. The keystrokes remain on the scratch
pad line in a static mode until (a) a new command is initiated, (b) the CLEAR
key is depressed, or (c) the MAJOR FUNC switch position is changed. Keyboard
syntax errors detected by the DEU will result in a flashing "ERR" on the scratch
pad line following the keyboard entry.

These symbols include an asterisk and a set of
parameter status indicators. Parameter status indicators are displayed in
"over-bright" intensity for quick recognition. These special symbols are defined
as follows:

M: This symbol
indicates missing data. It is displayed directly to the right of the affected
parameter. The parameter value may be blanked, or the last value received by the
GPC may be displayed. If data are missing for a parameter that has no numerical
value associated with it, then an M is used to indicate the parameter status.

H:
This symbol indicates that a parameter is off scale high. This indicates a
transducer limit has been reached, and the scale is registering its highest
possible value. The actual parameter being measured may, in fact, be higher than
the recorded data, but the instrument in use does not have the capacity to
measure the value. Off-scale high indicators do not appear on the display until
several (normally two) consecutive readings have verified this finding. This
symbol is displayed to the right of the data affected.

L: This symbol
indicates off-scale low parameters. This means that the parameter value
displayed is the lowest possible reading due to transducer limitations. The
actual value of the parameter may exceed the displayed value, but the range of
the hardware is not defined to evaluate this reading. As with the "H," the
off-scale low indicator is not displayed until a set number of consecutive
readings have verified this status.

Up arrow: This
symbol, displayed to the right of the affected parameter, indicates a parameter
driven out-of-limits high. The value displayed is a true reading but has equaled
or exceeded the operational high limit established by the software. The fault
detection and annunciation (FDA) software keeps track of the low and high limits
for each parameter and annunciates any violation of these limits to the crew by
displaying the appropriate "up arrow" or " down arrow" next to the parameter on
the appropriate display.

In the case
where the transducer limit is the same as the operational limit, the "H" symbol
overrides the "up arrow" symbol. Several (normally two) consecutive readings
verify this status before the "up arrow" symbol is displayed.

Down arrow:
This symbol indicates that a parameter value is equal to or less than the
operational low limit. The value displayed is outside the software limits placed
upon the parameter. When the software limit established is the same as the
transducer limit, the "L" symbol takes precedence over the "down arrow" symbol.
A set number of consecutive readings verifies this indication before the "down
arrow" is displayed.

In addition, the down arrow is used to indicate a
discrete state that does not agree with the nominal state. For example, a high
pressure gas supply valve state reading "closed" when its position is normally
"open" would drive the "down arrow" symbol.

The down arrow is also used to indicate that a
hardware unit has been declared failed by a GPC.

: This symbol indicates a redundancy management dilemma.
That is, if two hardware units measuring the same parameter disagree, and the
software cannot isolate which of the two is failed, a "?" will be displayed in
both places.

*: This symbol indicates an active state or the selected
item of mutually exclusive items.

Within a given display, certain operations can
be performed by the crew. Those items that may be altered are identified by an
item number. The item number is a maximum of two digits and is placed in such a
way that it is readily identifiable with the parameter or status configuration
with which it is associated. When item numbering is obvious, item numbers may be
implied and will not appear on the display. Item numbering is sequentially
ordered for each display. There are never more than 99 items per display. The
two basic types of manipulations that the crew can perform are item
configuration change and item data entry.

This operation allows the crew to choose any of a
number of options or to initiate a specific action as defined by the particular
display format. Typical purposes of this operation include selecting or
deselecting an item, initiating and executing an action, and altering software
configurations. The procedure used in performing an item configuration change
within a selected display is as follows:

This operation allows the crew to load data into
the software. Typical purposes of this operation include initializing
parameters, changing software limits, and specifying memory locations. The
procedure used in performing an item data entry is as follows:

1.

Depress the ITEM key.

2.

Key
in the item number.
Item numbers are ordered sequentially (1, 2, 3, . . .) on each display. They are
located next to the parameter to which they are assigned. Some item numbers must
be inferred by their surrounding item numbers.

3.

Key
in a delimiter
("+" or "-"). A delimiter serves to separate item number codes from their
corresponding data. The delimiter whose sign corresponds to the sign of the data
should be used, but if no sign is associated with the data, it doesn't matter
which delimiter is used. A "[ ]" after the data field indicates that the entry
is sign-dependent.

4.

Key
in the data.
Data size specifications depend on the format established for that particular
data load. Usually, the data size will be indicated with an underline for each
digit. As a general rule, leading and trailing zeros need not be entered.
Remember that the sign of the delimiter is the sign of the data.

Multiple item configuration changes cannot be
done; however, multiple item data entries can. Multiple data entries can be made
with separate command strings, but because this is time consuming, the software
allows more than one data entry to be made with one command sequence. The
procedure is the same as described above except step 4 (after data are keyed
in). Add step 4a to make more than one item data entry at once.

4a. Key in a delimiter. Consecutive data entries
may be loaded by using a delimiter to separate each parameter. Item entries are
incremented sequentially so the item number need not be entered for each
parameter following the one already entered. Just hit another delimiter, and the
next item number will appear, ready to receive its associated data. To skip an
item number, hit a delimiter twice. In this way, any amount of item numbers may
be skipped until the desired item number is reached.

Both the "+" and the "-" keys may be used
interchangeably as delimiters. However, when skipping item numbers, it is a good
idea to use the delimiter corresponding to the sign of the next data entry if
there is any sign associated with it. Using the sign key corresponding to the
next data entry ensures that the GPC receives the proper data entry.

An example of a multiple item data keyboard entry
is:

ITEM 7 + 2 + 1 + + 2 + - - 2 EXEC

In this example, Items 7, 8, 10, and 13 have no
sign associated with them so the sign of the delimiters doesn't matter. Although
there was room for four item entries here, the actual number allowed on the
scratch pad line is a function of the size of the data.

This entry will appear on the scratch pad line of
the corresponding CRT as:

ITEM (07) + 2 (08) + 1 (10) + 2 (13) - 2 EXEC.

All item operations will be one of these two
basic manipulations. However, data size and form will differ for each display.
Remember, only OPS and SPEC displays allow item operations. A DISP display does
not.

GPC assignment to a particular DEU/CRT set is
determined via a predefined table of assignments This table is stored in all the
common set GPCs' systems software and can be manipulated by the crew. There is a
table for each memory configuration (MC) that is valid when that MC is active
(loaded in one or more GPCs), and the particular major function is selected.
This table can be changed using the GPC MEMORY display (SPEC 0). The current GPC
driver for a CRT is controlled by the

MAJ FUNC
switch. That is,
the position of the MAJ FUNC switch (GNC,
SM, or PL)
will determine the GPC with which the DEU communicates. In some cases, a
redundant set of GPCs is formed for GNC, and the GNC CRTs are normally split
among them. This is done with the predefined table. The table is looked at by
the GPCs when they are loaded with the applications software, and that is when
the assignments take effect.

Another way to change the current GPC assignment logic is
with the GPC/CRT key. The GPC/CRT key allows the crew to reassign a CRT to a
different GPC commander. The steps for selecting a GPC to command a given
DEU/CRT are as follows:

1.
Depress the GPC/CRT key.

2. Key in the desired GPC number
(1, 2, 3, 4, or 5)

3. Key in the desired CRT number
(1, 2, 3, or 4). No
delimiter is needed between the GPC and the CRT numbers.

4. Depress the EXEC key

.

An assignment is not executed if the GPC being
assigned doesn't have the applications software in memory to support the DEU/CRT
in its current major function. If the GPC specified by a keyboard entry is not a
valid assignment, the reassignment does not occur, and the current GPC driver
retains the CRT. Thus, if a CRT is in

GNC, and an attempt is made
to assign a GPC that is not in the redundant set to drive it, a redundant set
(or valid) GPC will drive the CRT instead of the invalid GPC. If GPC 4 is the SM
machine (nominal configuration), then it is the only valid GPC to drive a CRT
whose MAJ FUNC switch is in
SM.

The payloads major function is usually
unsupported

. This means that
none of the GPCs have payload applications software loaded in them. Any GPC can
be assigned to drive a CRT in an unsupported major function. The GPC that was
driving the CRT in the previous major function will retain the CRT when it is
placed in PL.

If the keyboard entry specifies a valid GPC, it
willoverride any assignment made by the software.
The keyboard entry assignment will remain in effect whenever the

MAJ
FUNC switch is in
a position supported by that GPC. A new assignment can be made via the keyboard.

The GPC/CRT key can also be used to isolate a DEU from
communication with all GPCs. This is accomplished by using "0" for the number of
the GPC. The PASS set can drive only three of the four CRTs at one time, so at
least one DEU is always isolated from PASS.

The DEU drives a big X over an isolated CRT to
remind the crew that the DEU is not receiving data. The DEU also annunciates a
POLL FAIL message to inform the crew that the GPC is no longer successfully
polling the DEU (not attempting to communicate with the DEU).

After a GPC has been IPL'd, the only software
resident is the systems software, and the GPC is in OPS 0 when moded to

RUN. Any applications software is loaded in from the MMU during an OPS
transition. There are two levels of applications software: the major function
base (MFB) and the OPS overlay. The MFB is that software common to all OPS in a
particular major function. For GNC, the MFB contains flight-critical software
and data that are retained from one mission phase to another, such as the
current state vector and inertial measurement unit processing. When a GPC is
transitioned from one OPS to another in the same major function (e.g., from GNC
OPS 1 [ascent] to OPS 2 [orbit]), the MFB remains in main memory, and only the
OPS overlay is loaded from the MMU and written over the old OPS. Of course, when
the major function changes (e.g., when GPC 4 is transitioned from
GNC OPS 1 to SM OPS
2), a new MFB is loaded in from the MMU along with the OPS overlay.

The controls for performing an OPS transition
(i.e., loading a new memory configuration into the GPC from the MMU) are on the
GPC MEMORY display (SPEC 0), which is also the OPS 0 OPS display. Item 1
determines the memory configuration (CONFIG) to be loaded. Currently, there are
eight different memory CONFIGs, besides memory CONFIG 0, which is post-IPL OPS 0
(no applications software loaded).

Associated with each memory configuration is a
nominal bus assignment table (NBAT). It is displayed via items 7-19 on SPEC 0
whenever a memory configuration is entered, and it tells which GPCs are in the
target set and which GPCs are to be in command of each data bus. The nominal
assignments are already loaded in GPC main memory preflight. However, these bus
assignments may be changed any time, including when an OPS transition is
performed.

An example of a typical nominal bus assignment
table is shown on SPEC 0 GPC MEMORY for GNC OPS 3.

Items 2-6 determine which GPCs will be in the
OPS. They are referred to as the "target" GPCs. In this case, GPCs 1-4 are
in a redundant set. If a GPC is not to be in that OPS, a 0 is entered in
that GPC's item number, which is one more than the GPC number. (Item 2 is
for GPC 1, etc.)

The commanders of the flight-critical data buses or
strings are entered in items 7-10. (String 1 is FF1 and FA1, etc.) In this
case, each GPC is set to command its same-numbered string.

The two PL buses are assigned together. For OPS 1 and 3 they are assigned to
GPC 1 via item 11 in case the BFS fails. When the BFS is in RUN (as it is
for entry), it commands the PL data buses.

CRTs 1, 2, 3 are assigned to GPCs 1, 2, 3
respectively, via items 12-14. Since the PASS can only control three CRTs at
a time, no GPC is assigned to CRT 4 during entry. Note that CRT assignments
are for a particular major function only.

The launch data buses are assigned via items
16 and 17. Since they have no function during entry, they are de-assigned.

Items 18 and 19 show that GPC 1 will command mass memory bus 1 for the OPS 3
transition, and GPC 2 will command mass memory bus 2, either if the
transaction fails on mass memory bus 1 or if MMU 2 is prime selected on SPEC
1 DPS UTILITY.

Since there are two identical MMUs, there must
be a method to tell the GPCs which one to use for a particular transaction. This
is done on DPS UTILITY SPEC 1 display via items 1 through 8. Only one MMU (and
its data bus) is assigned to each major function. A post-IPL OPS 0 GPC also has
an MMU assigned to it for requesting freeze-dry software for a memory store.
Thisdisplay is initialized with all assigned to MMU 1, and execution of any of
the item numbers causes the appropriate MMU to be assigned.

Note that each of the pairs of item numbers is
mutually exclusive.

When a GPC needs to access mass memory, this
table tells it which MMU to use. For example, the SM GPC may need to call a
roll-in SPEC or take a checkpoint (discussed later). In the case of OPS
transitions, if the MMU selected is busy or fails twice, then the other is
automatically tried. For a GNC OPS transition where a redundant set is involved,
one GPC is assigned to each mass memory bus via items 18 and 19 on SPEC 0
GPC MEMORY. The indicated GPC will command the mass memory bus selected by item
1 or 2 on SPEC 1 DPS UTILITY, then the other GPC will command the next mass
memory bus if the first transaction fails. Of course, all GPCs in the redundant
set will be listening over both buses and receive the overlay.

During an initial program load (IPL), an MMU is
selected as the software source via the IPL SOURCE switch on panel O6. This
switch is a three-position toggle switch that will be either in the MMU 1 or MMU
2 position during the IPL sequence. At all other times, this switch will
nominally be in the OFF position.

The controls for selecting the memory source for
an OPS transition and the bus over which it is loaded into the GPCs are on SPEC
1 DPS UTILITY (items 9 through 11). The display is initialized with item 9
selected, which is almost always used. As part of the GPC status exchanged at
common set sync, each GPC exchanges its current resident memory configuration.
When a request is made for a memory configuration, the software determines
whether or not another GPC already has the requested OPS or a current major
function base. If another GPC already has any of the requested software, the
lowest numbered such GPC will be used as a source for the other GPCs. Such a
GPC-to-GPC overlay of software will be done over the mass memory data buses. An
overlay that is not available from a GPC will be loaded from an MMU. Note that
the major function base may come from another GPC and the OPS overlay from mass
memory. For transitions to OPS 3, the G3 archive (stored in the upper 128 k of
main memory prelaunch) is simply copied to lower memory and executed.

If there is a problem with both of the mass
memory data buses, then item 11 may be selected if there is a GPC source for
both overlays. In this case, the GPC-to-GPC overlay is done over the launch data
buses. Memory reconfiguration may be forced from an MMU, regardless of other GPC
sources, by selection of item 10 on the DPS UTILITY display. In this case,
whether both are required or not, both the major function base and the OPS
overlay will be loaded from mass memory. This would only be used if the software
in a current GPC was suspect for some reason.

If there is no usable GPC source and the selected
MMU is off or being used for another memory transaction, the class 3 fault
message OFF/ BUSY MMU 1 (2) is initiated. The current status of each MMU is
shown on the DPS UTILITY display as either RDY (ready to respond) or BSY (off or
currently responding to a GPC command).

When a GPC detects an error or is missing data
from a piece of equipment, a fault message will be displayed on the CRTs, the

SM ALERT light and tone will be
activated, and further attempts by the GPC to communicate with the equipment
will be terminated. Two common causes of detected errors or missing data are the
powering down of equipment or an error in a data transmission. In these two
cases, if the equipment is to be powered up, or if the error has been corrected,
it is desirable to restore the GPC's data input to the nominal configuration.
Restoring input is done through the I/O RESET key in the affected major
function. If an I/O RESET is performed only on a GNC GPC, theentire redundant
set of GNC GPCs will be restored to nominal I/O configuration. If it is
performed on the SM GPC, only the SM GPC's I/O configuration will be restored to
nominal. To reset I/O configurations, the procedure is as follows:

Select desired
MAJ FUNC.

Depress the I/O RESET key.

Depress the EXEC key.

If the powered down equipment has been powered
on, or if a problem with a piece of equipment has been fixed, an I/O RESET will
resume communication, and it will not cause another fault message annunciation.
If the GPC still has a problem communicating with any piece of its assigned
equipment, a fault message will re-annunciate after an I/O RESET. This
termination of attempts by the GPC to communicate with its assigned equipment is
called a comm fault (i.e., the input element has been bypassed by the GPC) and
the resultant loss of input data to applications software is also referred to as
a comm fault.

Systems summary displays provide general systems
status information that can be accessed quickly to aid immediate diagnosis of a
problem. They are designed to support the caution and warning (C/W) matrix
located on panel F7. When a C/W alarm occurs, the crew can call a systems
summary display that has general information from several systems to pinpoint
the problem to a specific system, then continue troubleshooting the problem on
system-specific SPECs, DISPs, and hardware panels. The systems summary displays
are DISPs and provide information only.

The systems summary displays are major
function-specific and are called with the SYS SUMM key. If a CRT's

MAJ
FUNC switch is in GNC,
and the SYS SUMM key is pressed, then GNC SYS SUMM 1 will appear on that CRT.
GNC SYS SUMM 1 is DISP 18 so it may also be called with a SPEC 18 PRO, but it is
faster to use the SYS SUMM key.

Five classes of alarms have been established.
Class 1, Emergency, has no interface with software. Class 2, Caution and Warning
(C/W), is the second highest alarm class. It is divided into primary
(hardware-driven) and backup (software-driven) systems. An alarm of the
software-driven class will result in the annunciation of the

BACKUP
C/W ALARM light on the C/W matrix on panel F7, the
MASTER ALARM lights, and an associated tone. In addition, a fault message will be displayed
upon the fault message line of the CRT. Class 3, Alert, triggers the SM ALERT
light and
corresponding tone. A fault message is displayed upon the fault message line.
Class 5, Operator Errors, is the lowest priority alarm and is caused only by a
crew entry error. It results in an ILLEGAL ENTRY fault message being displayed.
Class 0, Limit Sense, provides a status indicator (down arrow, up arrow) to the
right of the affected parameter on an appropriate CRT. No fault message, tone,
or light is triggered.

The output of a fault message to the fault
message line results in several indications requiring crew interface. Although
generally the crew keyboard responses are similar, the effects of these
responses differ for each class alarm.

The crew response to a class 2 backup fault
message is:

1.

Depress the MASTER ALARM pushbutton indicator.
This will extinguish the MASTER ALARM light and caution and warning tone.

2. Depress the
ACK key (on the keyboard). The fault message will
cease flashing. If the crewmember can examine the message while it flashes, this
step is unnecessary. Depress the ACK key again to look at the next message in a stack if
required.

3. Depress the
MSG RESET key. Depression of this key removes the
fault message from the fault message line. In addition, the BACKUP C/Wlight is extinguished. (Hardware driven
lights remain on until the problem is corrected.)

The crew response to a class 3 fault message is:

1. Depress the
ACK key. This will cause the fault message to become
static. Depression of the ACK key will also extinguish the SM ALERT light and tone. (The
tone duration is set to a crew selected length and may have stopped before the
ACK key is pressed.) Depress the ACK key again to look at the next message in a
stack if required.

2. Depress the
MSG RESET key. This will remove the fault message
from the fault message line. If the ACK key had not been depressed, the MSG
RESET key would extinguish the SM ALERT

light and tone.

A class 5 fault message displays a flashing
"ILLEGAL ENTRY" on the fault message line. The crew response is simply to
depress the

MSG RESET key. This clears the fault message from the
fault message line. The ACK key will not clear an "ILLEGAL ENTRY." It will cause
messages stacked under the "ILLEGAL ENTRY" display to be acknowledged and
cleared.

Some illegal keyboard entries are detected by the
DEU before being sent to the GPCs. When this occurs, a flashing "ERR" appears
immediately to the right of the erroneous entry on the scratch pad line. The
crew response is simply to depress the CLEAR key. Upon depression of the CLEAR
key, the "ERR" and the last keystroke will disappear. Subsequent depressions of
the CLEAR key will remove single keystrokes, proceeding from right to left. This
feature enables the crew to CLEAR back to the portion of the command that was
incorrect, correct it, and proceed. This type of error is not identified by
class, since it is not GPC-detected and is known simply as a DEU-detected error.

The major field is a 14-character field. The
first three characters identify the display on which more information about the
annunciated failure can be found. An S or a G, followed by a two digit number,
indicates the major function (G for GNC and S for SM) and the number of the SPEC
or DISP. If no display is associated with the fault, this field is blank. In the
example below, "S88" is the CRT ID and means that information on the fault can
be found on SPEC 88 in SM.

The remaining characters identify the problem or
subsystem group associated with the fault. In the example, "EVAP OUT T" is the
FAULT portion of the major field and indicates a fault in the flash evaporator
subsystem.

The minor field is a four-character field that
further identifies the fault. It will specify the subdivision, direction,
location, parameter, or specific unit of the subsystem or problem identified in
the major field. In the example fault message, "1" is the minor field message
and means that the temperature sensor 1 is the area in which the fault was
detected.

The C/W field is used only with caution and
warning class 2 backup messages. An asterisk appears in this column across from
the corresponding fault to denote that the condition is a class 2 backup alarm.

The GPC field identifies the GPC that detected
this fault. This characteristic aids the crewmember in locating or identifying
internal GPC or I/O errors.

The far right field is the TIME field. This field
indicates the time at which the fault occurred. The time is MET and is displayed
in hours, minutes, and seconds (HH:MM:SS).

A complete listing of all possible fault messages
can be found in the Flight Data File Reference Data Book and in Section 2.2.

A class 5 alarm is annunciated by an "ILLEGAL
ENTRY" in the major field, and all other fault message fields are blank. When a
class 5 message is received, it is displayed instantaneously on the fault
message line of the CRT where the error occurred, rather than on all CRTs like
class 2 and 3 errors. To get rid of the class 5 message, a MSG RESET must be
done to the CRT where the error occurred. Class 2 backup and class 3 messages
are extinguished by a MSG RESET on any CRT.

A historical summary of class 2 backup and class
3 fault messages is provided via the FAULT display (DISP 99). Class 5 errors are
not displayed as they are caused by illegal crew entries to a single DEU. The
FAULT display is a DISP available in all OPS. It is selected for viewing by
depression of the FAULT SUMM key.

The PASS fault summary display consists of up to
15 fault message lines. They appear in reverse chronological order. The oldest
message appears on the bottom line. When a new fault message is generated, it
appears on the top line. The other messages are pushed down, and the 15th
message (the oldest) disappears.

The only difference between the fault messages on
the FAULT display and the fault message on the fault message line is the TIME
field. On the FAULT display, the time field includes days as well as hours,
minutes, and seconds (DDD/HH:MM:SS).

Sometimes, a subsystem failure or malfunction
results in the output of several fault messages, some of which may be identical.
The fault detection and annunciation logic can prevent the annunciation of
identical fault messages. When a fault message is generated, its major and minor
fields are compared to those of the top message of the display. If the fields
are the same, and if the new fault message has occurred within a 4.8second window, the new message is inhibited.

The last message displayed on the fault message
line of any CRT is not necessarily the most recent fault message. Unless the
fault message line was cleared with a MSG RESET, the crewmember will not see any
new messages that came in after the flashing or frozen message. In that case,
the crewmembers can see if a new message has been annunciated by looking at a
two-character field. This field is called the buffer message indicator and is
located in the last field on the far right of the fault message line.

The buffer message indicator serves to indicate
the number of messages in the fault buffer on the FAULT display since the last
MSG RESET. This number includes class 2 backup and class 3 messages only. Class
5 messages and the currently displayed messages are not included in this
counter. The number is enclosed by parentheses. If no fault messages are in the
stack, this field is blank. To view any of these messages, the crewmember may
depress the ACK key to display subsequent messages or look at the FAULT display.
A MSG RESETclears both the fault message line and
the buffer message indicator.

In addition to using the FAULT SUMM key, the
FAULT display may also be selected by the keyboard entry "SPEC 99 PRO." However,
this command will clear all fault messages from the FAULT display and the fault
message lines. This capability is useful if and when the fault messages
displayed are no longer significant (i.e., they are old, or they have been dealt
with).

The crew software interface with the BFS is
designed to be as much like PASS as possible, but there are some differences.
This section covers the differences between the PASS's and BFS's crew and CRT
interfaces. If something is not mentioned in this section, it can be assumed to
operate the same as the PASS interface.

BFC CRT DISPLAY switch is a two-position ON/OFF
switch. In the ON
position, the CRT(s) specified by the BFC CRT
SELECT switch is driven by the BFS computer. (The
BFC CRT SELECT switch controls CRT assignment to the BFS computer.) The switch is read by the
GPC only when the BFC CRT DISPLAY switch is in the ON position.
The BFC CRT SELECT switch has three positions. In each position, the
first digit is the CRT commanded by the BFS pre-engage. Post-engaged, the BFS
also commands a second CRT indicated by the second number. For example, when the
BFC CRT SELECT switch is in the
1 + 2 position, CRT 1 is connected
to the BFS GPC prior to engaging the BFS. After the BFS is engaged, this
switch position allows the BFS computer to command both CRT 1 and CRT 2. In the
2 + 3 position, CRT 2 is commanded by the BFS GPC prior
to engaging the
BFS. Post-engaged, this switch allows CRT 2 and CRT 3 to be supported by the BFS
computer. In the 3 + 1 position, CRT 3 is driven by the pre-engaged BFS GPC.
Upon engaging the BFS, both CRT 3 and CRT 1 will be assigned to the BFS
computer.

During ascent and
entry, one CRT will normally be assigned to the BFS via the BFC CRT SELECT
switch. The nominal position of the switch is the 3+1 position. However,
this switch position may be changed at any time, pre-engage or post-engage. If
the BFS is engaged with the BFC CRT DISPLAY switch OFF,
the BFS will automatically assume command of CRTs 1 and 2.

switches
on panels C2 and R11L are also functional for the BFS. However, the display data
and functional software accessed by the three-position switch are slightly
differ ent. The BFS functions of the MAJ FUNC switch are defined as follows:

GNC:
Flight critical software including limited guidance, navigation, and control
software is contained in this major function. The BFS GNC major function
contains only that software necessary for safe orbital insertion and return,
including ascent abort logic.

SM:
This major function contains limited nonredundant systems management and
payload software. There is no room in the BFS for the redundancy management
found in PASS. When the MAJ FUNC switch is set in
the SM position, the THERMAL display is invoked. This display is unique to
the BFS.

PL: This
major function is not functional for the BFS. Should the MAJ FUNC switch be set in
this position, no display change would occur. If the BFC CRT DISPLAY switch is
turned on, allowing the BFS to drive a CRT already in the PL major function,
the CRT will be blank except for time and GPC driver fields because the BFS
has no software to support this major function.

The BFS ENGAGE pushbutton is located on the
commander's and pilot's rotational hand controllers (RHCs). During the dynamic
flight phases (ascent and entry), the commander and pilot usually rest a hand on
or near the RHC. In this way, BFS engagement can occur as quickly as possible.
If the crew delays engagement during these flight phases, they could lose
control of the vehicle, or the BFS' navigation calculations could degrade very
quickly so that control would be essentially lost after engagement.

Some force (8 lb) is required to depress this
pushbutton to prevent inadvertent engages. While on-orbit, the pushbutton is
essentially disabled by reconfiguring the BFS OUTPUT switch. The BFS cannot
track PASS while it is in OPS 2 and is moded to HALT on-orbit. If the BFS needs
to be engaged on-orbit, the BFS must be "awakened", and the only software that
will be of any use is entry and systems management software.

The keyboard operates exactly the same way for
the BFS as for the PASS. A few additional capabilities need to be mentioned.

The
GPC/CRT key: In addition to the BFC CRT DISPLAY
switch, this key provides the capability to
assign a CRT to (or isolate a CRT from) the BFS GPC. Both methods can be
used interchangeably, but as long as the BFC CRT
DISPLAY switch is working, it is the fastest
method of allowing the BFS to drive a CRT or to change BFS CRTs. The BFC CRT DISPLAY switch allows PASS to automatically begin
driving the CRT again when the BFS is turned off. When the BFS is assigned a
CRT with the GPC/CRT key, it is the same as deassigning that screen from
PASS with a GPC/CRT 0X EXEC. PASS must be reassigned to resume commanding of
that CRT.

The BFS INDICATOR: When the BFS is commanding
a CRT, the BFS indicator will appear on the CRT being commanded. On the
second line of every BFS display a three-character space field has been
reserved for the message "BFS." This field is located directly below the GPC
indicator. The BFS indicator is displayed in the over-bright intensity and
is intended to prevent possible confusion of a PASS display with a BFS
display. Often the BFS display will be identical or very close to the
corresponding PASS display

The BFS is designed to operate in the same manner
as the PASS where possible. BFS requirements, however, demanded a distinction be
made between BFS pre-engage and BFS postengage major mode transitions and
associated display sequencing.

BFS pre-engage major mode display sequencing is
either automatic, or it may be performed in the same manner as that of the PASS.
Before the BFS is engaged, the BFS CRT is listening to the PASS CRT across the
display/keyboard (DK) buses and updating its software accordingly.

This is called DK listening and the BFS can hear
PASS item entries, PASS major mode transitions, and PASS GPC/CRT assignments. On
the other hand, the PASS doesn't know that the BFS exists, so it never DK
listens to the BFS. Therefore, BFS major mode transitions are performed
automatically as a function of the major mode transitions performed on a PASS
keyboard. If the BFS does not follow the PASS major mode transitions, then the
BFS must receive a manual OPS XXX PRO on its CRT.

BFS post-engage major mode display sequencing is
the same as that of the PASS. After the BFS is engaged, the BFS GPC is on its
own. It no longer listens to the PASS GPCs. Therefore, major mode display
sequencing has been designed to be the same as that of the PASS.

Three operational sequences are defined for BFS
GNC; one operational sequence is defined for the BFS SM. Transactions to and
from these OPS displays differ considerably from the PASS. BFS keyboard and CRT
peculiarities are outlined as follows:

BFS GNC OPS 0 - BFS MEMORY display: This
display is forced to the CRT when BFS is not processing either GNC OPS 1 or
3. Nominally, this occurs prior to ascent and again prior to entry. This
display corresponds to the PASS GPC MEMORY display and performs the same
functions for the BFS. It also performs some of the same functions as PASS
SPEC 2, the TIME SPEC, in that time updates can be performed along with
selection of GMT or MET to be displayed. GPC MEMORY is the default display
for PASS OPS 0, and the BFS MEMORY display is the default display for BFS
GNC OPS 0.

BFS GNC OPS 1 and 6 - Ascent: This OPS must
be manually selected via a keyboard assigned to the BFS prelaunch. BFS GNC
OPS 1 is available for use during the ascent portion of the mission. The OPS
6 transition is automatic upon abort selection with the ABORT rotary switch
and pushbutton, or an OPS 601 PRO may be used.

BFS GNC OPS 3 - Entry: This OPS must be
manually selected from BFS GNC OPS 0 or BFS GNC OPS 1. BFS GNC OPS 3 is
available for use during the entry portion of the mission. It is a legal
transition to go from the BFS GNC OPS 1 to BFS GNC OPS 3 (for aborts), but
nominally, the transition will be from BFS GNC OPS 0. In both cases, themanual keyboard entry "OPS 301 PRO" is required.

The major mode displays for BFS OPS 1, 3, and
6 are similar, if not identical, to their PASS counterparts. A complete
listing of PASS and BFS displays can be found in the DPS Dictionary.

In the pre-engaged mode, the BFS GPC performs BCE
and MDM bypasses when PASS data are bypassed,
or it sets its own bypasses. The I/O RESET command when made via the BFS
keyboard restores those I/O configurations set by the BFS GPC. That is, a BFS
"I/O RESET EXEC" restores the bypasses set by the BFS GPC. In addition, the I/O
RESET operation attempts to synchronize the BFS with the PASS GPC listen
commands so the BFS can track PASS.

Post-engage, the only bypasses set are those
detected by the BFS GPC. The "I/O RESET EXEC" command functions to restore those
bypasses.

The BFS systems summary displays operate the same
way the PASS displays work. The BFS display numbers are the same as their PASS
counterparts and some of the displays themselves are identical. However, three
of the BFS SYS SUMM displays are unique to the BFS.

GNC SYS SUMM. The GNC SYS SUMM consists of
two DISPs. GNC SYS SUMM 1 is display format and content unique to BFS. It is
called via the SYS SUMM key or by the command "SPEC 18 PRO." GNC SYS SUMM 2
is identical to the GNC SYS SUMM 2 display available in the PASS OPS 2 and
8. It is called by the command "SPEC 19 PRO" or by depressing the SYS SUMM
key twice.

SM SYS SUMM. There are two SM SYS SUMM
displays. SM SYS SUMM 1 is identical to the PASS SM SYS SUMM 1, while BFS SM
SYS SUMM 2 is a unique display. They are called in the same manner as the
PASS SM SYS SUMM displays.

THERMAL. This is a systems summary DISP available as the SM OPS 0 display in
BFS. It is forced to the screen anytime the MAJ FUNC switch is placed in the
SM position (unless an SM SPEC is called up over it). This display is unique
to the BFS. It cannot be obtained with a SPEC key, and it never requires a
keyboard entry alarm. The BFS FAULT display provides a history of only class
2 backup and class 3 messages annunciated by the BFS GPC itself.

·
DPS hardware includes five GPCs, two mass memory units, a data bus network, 20
MDMs, four CRTs, and other specialized equipment.

·
Each of the five GPCs consists of a CPU and an IOP stored in one avionics box.
During ascent/entry, four of the GPCs are loaded with identical PASS software;
the fifth is loaded with different software, the BFS.

·
The 13 DPS MDMs convert data to appropriate formats for transfer between the
GPCs and vehicle systems. OV 105 has all EMDMs.

·
Two mass memory units provide bulk storage for software and data.

·
Four CRTs (three on panel F7 and one on panel R11L) and associated keyboards
provide the means for flight crew interaction with the GPCs.

·
The two types of DPS software, system software and applications software,
combine to form a memory configuration for a specific mission phase.

·
The system software is operating software that always resides in GPC main
memory.

·
The applications software performs the functions required to fly and operate the
vehicle. It is divided into three major functions: guidance, navigation, and
control (GNC); systems management (SM); and payload (PL).

·
OPS are further divided into blocks called major modes (MM), which relate to
specific portions of a mission phase.

·
There are three levels of CRT displays: major mode or OPS, specialist (SPEC),
and display (DISP).

·
The four PASS GPCs control all GNC functions during ascent/entry mission phases;
the fifth GPC is loaded with backup flight system (BFS) software to take over in
case of PASS GPC failure.

·
The BFS contains a limited amount of software; there are some operational
differences between BFS and PASS.

·
The BFS is engaged by pushbutton on the rotational hand controller.

·A GPC FAIL detection will display a class 2 GPC FAULT message with illumination
of the MASTER ALARM. The GPC STATUS
matrix (sometimes referred to as the computer annunciation matrix (CAM)) on
panel O1 lights to indicate failure votes; any time a yellow matrix light is
illuminated, the GPC caution and warning light on panel F7 also lights.

·
Most DPS control switches are located on panels O6 and C2. Others may be found
on panels C3, R11L, F2, F4, F6, and F7.

·
Before OPS transitions and restrings, always verify the appropriate NBAT is what
you want it to be; never assume that it is correct! Also check the proper major
function and GPC switch configuration.

·
Make sure you have the correct memory configuration called up before you start
making NBAT changes.

·
Clear the Fault Message line as soon as you have seen the message or use the ACK
key to display subsequent messages.

·
Post BFS engage, check to ensure that all active PASS GPCs have recognized the
engage (both MODE and OUTPUT talkbacks are barberpole). If not, take the
offending GPC to HALT (or if this doesn't work, power it OFF) immediately to
avoid I/O problems on the flight critical strings.

·
It is a very good idea to resume SPECs and DISPs from CRTs when not using them
or before going to another major function on that CRT.

·
It is important to be able to identify GPC failures. The information you provide
will affect Mission Control analysis and its ability to plan for subsequent
failures (both DPS and non DPS).

·
Always hard assign CRTs (both PASS and BFS) via PASS CRTs (BFS will DK listen).
You can cause dual CRT commanders if you try to assign BFS to a CRT that a PASS
CRT is still driving.

·
Always distribute your CRTs among different GPCs. On orbit, always be sure to
minimize SM usage on all CRTs at the same time; if you lose SM, you also lose
PASS CRT interface. The same is true if in single GPC GNC OPS, such as Spacelab
missions.

·
When using the GPC MODE switch, always take your hand off between positions. On
past missions, there have been problems with the switch being in essentially two
positions at the same time. This problem can occur on other orbiter switches
too. It is a good idea to always pause slightly in each switch detent to ensure
the contacts are made and recognized by the GPCs.

·
The CRT SEL switch should always be checked before making a keyboard entry, and
data should always be checked on the CRT scratch pad line before it is entered.

·
When moding PASS GPCs into the common set (i.e., STBY to RUN), always pause 10
seconds before and after switch throws to avoid a possible fail-to-sync and to
ensure proper common set initialization.